Scribd
Upload
1K views21 pages

Security Onion - Network Security Monitoring in Minutes

This document discusses Network Security Monitoring (NSM) using Security Onion. Security Onion allows setting up NSM in just 2 minutes using a setup wizard. It collects and correlates multiple data types including alerts, sessions, transactions, and full packet captures. The Sguil analysis interface integrates these data types and allows pivoting between them. Security Onion provides tools for packet analysis, hunting for malware, and monitoring hosts with OSSEC. The document encourages contributions to the open source Security Onion project.

Uploaded by

clu5t3r
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
1K views21 pages

Security Onion - Network Security Monitoring in Minutes

This document discusses Network Security Monitoring (NSM) using Security Onion. Security Onion allows setting up NSM in just 2 minutes using a setup wizard. It collects and correlates multiple data types including alerts, sessions, transactions, and full packet captures. The Sguil analysis interface integrates these data types and allows pivoting between them. Security Onion provides tools for packet analysis, hunting for malware, and monitoring hosts with OSSEC. The document encourages contributions to the open source Security Onion project.

Uploaded by

clu5t3r
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 21

Security

Onion
Network Security Monitoring in Minutes

Doug Burks

Feel the pain


Does your tradi;onal IDS give you all the data you need?

The Beauty of Network Security Monitoring


l

Mul;ple data types (not just IDS alerts)

Sguil is the de facto reference implementa;on of NSM:


l
l
l
l

Alert data (NIDS alerts from Snort/Suricata and HIDS alerts from OSSEC)
Session data (SANCP)
Transac;on data (HTTP logs from Bro)
Full content data (daemonlogger)

Lots of pieces in the jigsaw puzzle

hNp://nsmwiki.org/images/e/ea/Sguil-0.7.dfd.png

Setup wizard puts the jigsaw puzzle


together for you!
Takes only 2 minutes!

Snorby
Web interface
Web 2.0
AJAX
Ruby on Rails
Buzzword compliant!

Squert web interface

The Ul;mate Analyst Worksta;on


l Security Onion in a VM on your Desktop
l Sguil client connects to Sguil server
l Pull pcaps back to your VM for extended analysis

Sguil client designed


by analysts for analysts

Right-click Src/Dst IP and Query SANCP


table (Session Data)

Right-click Src/Dst IP and query Event table


to access HTTP logs (Transac;on Data)

Right-click Alert ID to pivot to Full Content


(transcript in Sguil or pcap in Wireshark)

PCAP Tools
We haz them

NetworkMiner
Theres gold in them
thar PCAPs!

Mul;ple Sguil sensors

hNp://securityonion.blogspot.com/2011/04/security-onion-20110321-distributed.html

Bro IDS
Bro records a tremendous
amount of ac;onable
intelligence about your
network trac. The logs can
be found in:
/nsm/bro/logs

Hunt for Evil User Agents


zcat /nsm/bro/logs/*/hNp* |bro-cut -d user_agent |sort |uniq -c |sort -nr

Look for malicious user agents like:


Bobs Evil Clown C&C Agent

or just outdated and vulnerable sohware like:
zcat /nsm/bro/logs/*/soh* |bro-cut -d name version.major |grep
Firefox |grep -v 12 |sort |uniq -c |sort nr
110 Firefox 3
71 Firefox 11
53 Firefox 10
hNp://pauldotcom.com/2011/10/in-search-of-evil-user-agents.html

Argus

NIDS is great, but what about HIDS?


l

OSSEC monitors local logs and can receive logs from OSSEC Agents and
standard Syslog

OSSEC alerts are stored in /var/ossec/logs/alerts/

Sguil OSSEC Agent transmits those alerts to the Sguil server

One-man bands make crappy music


Interested in joining an open source project?
Security Onion needs:
l

Documenta;on

Artwork

Web interface

Performance benchmarks

Package maintainers

hNp://code.google.com/p/security-onion/wiki/TeamMembers

Where do we go now?
hNp://securityonion.blogspot.com

Updates are announced here and it also has the following links:

l

Download/Install

FAQ

Mailing List

IRC #securityonion on irc.freenode.net

You might also like